@agent-native/core 0.100.0 → 0.100.2

package/corpus/core/src/secrets/storage.ts

@@ -1,13 +1,13 @@
 /**
  * Storage layer for the framework secrets registry.
  *
- * Values are encrypted at rest with AES-256-GCM. The encryption key is
- * derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the existing
- * `BETTER_AUTH_SECRET` env var (fallback so templates don't need a second
- * secret during development). If neither is set in production we fall back
- * to a machine-local key derived from the cwd — the secret is still only
- * readable on this machine, but consider setting `SECRETS_ENCRYPTION_KEY`
- * for a stable, rotatable key.
+ * Values are encrypted at rest with AES-256-GCM. The workspace-shared
+ * encryption key is derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the
+ * existing `BETTER_AUTH_SECRET` env var (fallback so templates don't need a
+ * second secret during development). Deployments that only have the legacy
+ * app-scoped key continue to work until shared key material is configured;
+ * once configured, new rows use the shared key and reads retain a legacy-key
+ * fallback for existing rows.
  *
  * Secret values are NEVER logged and NEVER returned from any route handler.
  */
@@ -17,8 +17,11 @@ import { randomUUID } from "node:crypto";
 import { getDbExec, isPostgres } from "../db/client.js";
 import { ensureColumnExists, ensureTableExists } from "../db/ddl-guard.js";
 import {
-  encryptSecretValue as encryptValue,
-  decryptSecretValue as decryptValue,
+  encryptSecretValue as encryptLegacyValue,
+  encryptSharedSecretValue as encryptValue,
+  decryptSharedSecretValue as decryptValue,
+  decryptSecretValue as decryptLegacyValue,
+  hasSharedSecretEncryptionKeyMaterial,
 } from "./crypto.js";
 import type { SecretScope } from "./register.js";
 import { APP_SECRETS_CREATE_SQL } from "./schema.js";
@@ -61,6 +64,11 @@ async function ensureTable(): Promise<void> {
           "url_allowlist",
           `ALTER TABLE app_secrets ADD COLUMN IF NOT EXISTS url_allowlist TEXT`,
         );
+        await ensureColumnExists(
+          "app_secrets",
+          "shared_encrypted_value",
+          `ALTER TABLE app_secrets ADD COLUMN IF NOT EXISTS shared_encrypted_value TEXT`,
+        );
         return;
       }
 
@@ -86,6 +94,16 @@ async function ensureTable(): Promise<void> {
       } catch {
         // Column already exists — expected
       }
+
+      // Additive migration: workspace-shared ciphertext. Keep the legacy
+      // encrypted_value column so older app versions remain readable.
+      try {
+        await client.execute(
+          `ALTER TABLE app_secrets ADD COLUMN shared_encrypted_value TEXT`,
+        );
+      } catch {
+        // Column already exists — expected
+      }
     })().catch((err) => {
       _initPromise = undefined;
       throw err;
@@ -95,7 +113,9 @@ async function ensureTable(): Promise<void> {
 }
 
 // ---------------------------------------------------------------------------
-// Encryption — see ./crypto.ts (shared with per-user credentials)
+// Encryption — see ./crypto.ts. Keep encrypted_value on the legacy app-key
+// format for mixed-version deployments, and add shared_encrypted_value when a
+// stable workspace key is configured so sibling apps can read the same row.
 // ---------------------------------------------------------------------------
 
 /**
@@ -141,7 +161,14 @@ export async function writeAppSecret(args: WriteSecretArgs): Promise<string> {
   }
   const client = getDbExec();
   const now = Date.now();
-  const encrypted = encryptValue(value);
+  // Dual-write during rollout: old readers continue using encrypted_value,
+  // while new readers prefer the nullable shared ciphertext. An app-only
+  // deployment leaves the shared column null; on an update, an existing
+  // shared ciphertext is preserved by the upsert below.
+  const encrypted = encryptLegacyValue(value);
+  const sharedEncrypted = hasSharedSecretEncryptionKeyMaterial()
+    ? encryptValue(value)
+    : null;
   const id = randomUUID();
 
   // Atomic upsert by (scope, scope_id, key). Previously this was a
@@ -155,10 +182,11 @@ export async function writeAppSecret(args: WriteSecretArgs): Promise<string> {
   // keeps its original id (any stored references stay stable); only a
   // genuinely new row gets the freshly generated `id`. This syntax is
   // portable across SQLite (UPSERT since 3.24) and Postgres.
-  const upsertSql = `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+  const upsertSql = `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, shared_encrypted_value, description, url_allowlist, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     ON CONFLICT (scope, scope_id, key) DO UPDATE SET
       encrypted_value = excluded.encrypted_value,
+      shared_encrypted_value = COALESCE(excluded.shared_encrypted_value, app_secrets.shared_encrypted_value),
       description = excluded.description,
       url_allowlist = excluded.url_allowlist,
       updated_at = excluded.updated_at`;
@@ -168,6 +196,7 @@ export async function writeAppSecret(args: WriteSecretArgs): Promise<string> {
     scopeId,
     key,
     encrypted,
+    sharedEncrypted,
     description ?? null,
     urlAllowlist ?? null,
     now,
@@ -201,6 +230,80 @@ export interface ReadSecretResult {
   updatedAt: number;
 }
 
+/**
+ * Read the shared-key format and retain compatibility with rows written before
+ * app_secrets moved to its workspace-shared encryption boundary. The legacy
+ * fallback is only useful when the current app owns the old row; sibling apps
+ * will receive shared-key ciphertext after the next vault sync or update.
+ */
+interface DecryptedAppSecretValue {
+  value: string;
+  /** True when the app-scoped fallback decrypted encrypted_value. */
+  usedLegacyKey: boolean;
+  /** True when shared_encrypted_value was not the source of the plaintext. */
+  needsSharedCiphertext: boolean;
+}
+
+function decryptAppSecretValue(
+  encrypted: string,
+  sharedEncrypted?: string | null,
+): DecryptedAppSecretValue {
+  if (sharedEncrypted) {
+    try {
+      return {
+        value: decryptValue(sharedEncrypted),
+        usedLegacyKey: false,
+        needsSharedCiphertext: false,
+      };
+    } catch {
+      // Fall through to the legacy column. A partially migrated row may have
+      // a stale shared ciphertext while the old app-key value is valid.
+    }
+  }
+  try {
+    return {
+      value: decryptValue(encrypted),
+      usedLegacyKey: false,
+      needsSharedCiphertext: true,
+    };
+  } catch {
+    return {
+      value: decryptLegacyValue(encrypted),
+      usedLegacyKey: true,
+      needsSharedCiphertext: true,
+    };
+  }
+}
+
+/**
+ * Populate the shared column without touching encrypted_value. This is
+ * intentionally best-effort: a read must still succeed if a deployment's DB
+ * role cannot update the row. The NULL predicate prevents a concurrent writer
+ * from overwriting newly-populated shared ciphertext, and leaving updated_at
+ * untouched preserves the row's user-visible ordering/metadata.
+ */
+async function populateSharedAppSecret(
+  id: unknown,
+  value: string,
+): Promise<void> {
+  if (
+    id === undefined ||
+    id === null ||
+    !hasSharedSecretEncryptionKeyMaterial()
+  ) {
+    return;
+  }
+  try {
+    await getDbExec().execute({
+      sql: `UPDATE app_secrets SET shared_encrypted_value = ? WHERE id = ? AND shared_encrypted_value IS NULL`,
+      args: [encryptValue(value), id],
+    });
+  } catch {
+    // Migration is opportunistic. Preserve the successful read if the update
+    // is unavailable due to a read-only role, transient DB failure, or race.
+  }
+}
+
 type AppSecretsReadQuery = { sql: string; args: unknown[] };
 
 /**
@@ -244,15 +347,22 @@ export async function readAppSecret(
 ): Promise<ReadSecretResult | null> {
   const { key, scope, scopeId } = ref;
   const { rows } = await executeAppSecretsRead({
-    sql: `SELECT encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,
+    sql: `SELECT encrypted_value, shared_encrypted_value, updated_at, id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,
     args: [scope, scopeId, key],
   });
   if (rows.length === 0) return null;
   try {
-    const value = decryptValue(rows[0].encrypted_value as string);
+    const encrypted = rows[0].encrypted_value as string;
+    const decrypted = decryptAppSecretValue(
+      encrypted,
+      rows[0].shared_encrypted_value as string | null,
+    );
+    if (decrypted.needsSharedCiphertext) {
+      await populateSharedAppSecret(rows[0].id, decrypted.value);
+    }
     return {
-      value,
-      last4: last4(value),
+      value: decrypted.value,
+      last4: last4(decrypted.value),
       updatedAt: Number(rows[0].updated_at ?? 0),
     };
   } catch {
@@ -273,7 +383,7 @@ export async function readAppSecrets(args: {
 
   const placeholders = keys.map(() => "?").join(", ");
   const { rows } = await executeAppSecretsRead({
-    sql: `SELECT key, encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key IN (${placeholders})`,
+    sql: `SELECT key, encrypted_value, shared_encrypted_value, updated_at, id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key IN (${placeholders})`,
     args: [args.scope, args.scopeId, ...keys],
   });
   const results = new Map<string, ReadSecretResult>();
@@ -281,10 +391,17 @@ export async function readAppSecrets(args: {
     const key = String(row.key ?? "");
     if (!key) continue;
     try {
-      const value = decryptValue(row.encrypted_value as string);
+      const encrypted = row.encrypted_value as string;
+      const decrypted = decryptAppSecretValue(
+        encrypted,
+        row.shared_encrypted_value as string | null,
+      );
+      if (decrypted.needsSharedCiphertext) {
+        await populateSharedAppSecret(row.id, decrypted.value);
+      }
       results.set(key, {
-        value,
-        last4: last4(value),
+        value: decrypted.value,
+        last4: last4(decrypted.value),
         updatedAt: Number(row.updated_at ?? 0),
       });
     } catch {
@@ -330,15 +447,22 @@ export async function readAppSecretMeta(
   const { key, scope, scopeId } = ref;
   const client = getDbExec();
   const { rows } = await client.execute({
-    sql: `SELECT encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,
+    sql: `SELECT id, encrypted_value, shared_encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,
     args: [scope, scopeId, key],
   });
   if (rows.length === 0) return null;
   const row = rows[0];
   let last4Value = "";
   try {
-    const value = decryptValue(row.encrypted_value as string);
-    last4Value = last4(value);
+    const encrypted = row.encrypted_value as string;
+    const decrypted = decryptAppSecretValue(
+      encrypted,
+      row.shared_encrypted_value as string | null,
+    );
+    if (decrypted.needsSharedCiphertext) {
+      await populateSharedAppSecret(row.id, decrypted.value);
+    }
+    last4Value = last4(decrypted.value);
   } catch {
     last4Value = "";
   }
@@ -366,18 +490,26 @@ export async function listAppSecretsForScope(
   await ensureTable();
   const client = getDbExec();
   const { rows } = await client.execute({
-    sql: `SELECT key, encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? ORDER BY updated_at DESC`,
+    sql: `SELECT id, key, encrypted_value, shared_encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? ORDER BY updated_at DESC`,
     args: [scope, scopeId],
   });
-  return rows.map((row) => {
+  const results: SecretMeta[] = [];
+  for (const row of rows) {
     let last4Value = "";
     try {
-      const value = decryptValue(row.encrypted_value as string);
-      last4Value = last4(value);
+      const encrypted = row.encrypted_value as string;
+      const decrypted = decryptAppSecretValue(
+        encrypted,
+        row.shared_encrypted_value as string | null,
+      );
+      if (decrypted.needsSharedCiphertext) {
+        await populateSharedAppSecret(row.id, decrypted.value);
+      }
+      last4Value = last4(decrypted.value);
     } catch {
       last4Value = "";
     }
-    return {
+    results.push({
       key: row.key as string,
       scope,
       scopeId,
@@ -386,8 +518,9 @@ export async function listAppSecretsForScope(
       urlAllowlist: parseAllowlist(row.url_allowlist as string | null),
       createdAt: Number(row.created_at ?? 0),
       updatedAt: Number(row.updated_at ?? 0),
-    };
-  });
+    });
+  }
+  return results;
 }
 
 function parseAllowlist(raw: string | null): string[] | null {

package/corpus/templates/assets/app/components/layout/Layout.tsx

@@ -67,6 +67,10 @@ export function Layout({ children }: LayoutProps) {
   useAgentChatHomeHandoffLinks({
     storageKey: ASSETS_CHAT_STORAGE_KEY,
     isChatPath: (pathname) => pathname === "/" || pathname.startsWith("/chat/"),
+    // A direct /chat/:id link already names the thread and must preserve the
+    // normal chat-to-sidebar transition. Only the empty home chat needs the
+    // recent marker that proves an agent handoff is in flight.
+    requireActiveHandoff: location.pathname === "/",
   });
 
   useEffect(() => {

package/corpus/templates/assets/app/hooks/use-navigation-state.ts

@@ -1,4 +1,5 @@
 import {
+  isAgentChatHomeHandoffActive,
   markAgentChatHomeHandoff,
   useAgentRouteState,
   getBrowserTabId,
@@ -190,7 +191,8 @@ export function useNavigationState() {
     onNavigate: (_command, path) => {
       if (
         isCreatePath(location.pathname) &&
-        !isCreatePath(pathnameFromPath(path))
+        !isCreatePath(pathnameFromPath(path)) &&
+        isAgentChatHomeHandoffActive(ASSETS_CHAT_STORAGE_KEY)
       ) {
         markAgentChatHomeHandoff(ASSETS_CHAT_STORAGE_KEY);
       }

package/corpus/templates/assets/changelog/2026-07-13-assets-keeps-the-right-chat-sidebar-closed-when-the-full-pag.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-13
+---
+
+Assets keeps the right chat sidebar closed when the full-page chat is empty.

package/corpus/templates/calendar/AGENTS.md

@@ -37,6 +37,15 @@ Detailed event, availability, booking, storage, and UI rules live in
   with `stageAs` and analyze them with `query-staged-dataset`.
 - For Google Calendar, distinguish an empty calendar from missing auth,
   reauth-needed, or fetch failures.
+- `list-events` remains the UI-compatible event list by default. External MCP
+  callers receive its compact, paginated version 1 inventory envelope
+  unless they explicitly request `format: "legacy"`; use `format: "inventory"`
+  for that same coverage-aware result from other callers. Preserve its
+  account coverage, `sourceCoverage`, and `coverageComplete` fields: Google
+  account, ICS feed, overlay, and local-booking sources are independent, and a
+  partial source failure is not an empty calendar. Pass `accountEmails` only
+  for connected accounts; the action validates the whole requested set before
+  provider work.
 - Google Calendar working locations are status events (`eventType:
 "workingLocation"`). Sync and display them as working locations, keep them
   transparent/non-blocking, and preserve `workingLocationProperties` instead of